Ransomware Recap: Nov. 7- 18, 2016

The reign of Cerber as one of the most visible ransomware families to have emerged of late continues with the consistent release of updated versions with evolved tactics. Just last October, three malvertising campaigns and a compromised site campaign was seen using version 4.0 (detected by Trend Micro as RANSOM_CERBER.DLGE), a version that was released just a month after version 3.0.  

Over the past two weeks, Cerber demonstrated new tricks it added in its updated versions. The evolved routines and techniques spotted early in its lifecycle include the addition of a DDoS component in its attack, the use of double-zipped Windows Script Files and cloud productivity platform, and acting as a secondary payload for an information-stealing malware. This time, Cerber, which earned almost US$200,000 in July, 2016 alone, attempts to ramp up its money-making schemes as it adds encrypting database files to its routines, possibly meant to go after bigger enterprise targets.

While other existing ransomware families have been known to encrypt database files, this routine was likely adopted by Cerber developers to target enterprises and businesses that are more likely to pay the ransom given the crucial nature of these files.  This routine was spotted in versions as early as 4.0 but has since been integrated into the succeeding versions of Cerber released within the past couple of weeks.

Cerber 4.1.5 (detected by Trend Micro as RANSOM_CERBER.F116K8), in fact, surfaced within a day after its previous version’s release. One of the samples studied by Trend Micro researchers involves a spam email spoofing an online payment service provider. Notifications of an exceeded credit line are used as a hook to coerce would-be victims into authenticating their accounts. This action leads to the download and installation of the ransomware into the system.  Other spam emails uncovered involve messages masquerading as an invoice, with attached Word documents embedded with malicious macro aiding in the download and execution of the ransomware.

Interestingly, it demands a cheaper ransom compared to its earlier variants. A “special” price of 0.0977 bitcoins is asked from the victim, or an amount equivalent to $69 on a five-day grace period. Failure to settle the ransom will increase the ransom to 0.1954 bitcoins (around $139).

With the success of Cerber, the emergence of copycats attempting to reap the same kind of notoriety and monetary rewards is no longer surprising. In the past couple of weeks, CerberTear (detected by Trend Micro as RANSOM_HIDDENTEARCERBER.A), a ransomware variant based on the open-source ransomware Hidden Tear surfaced. Following its file encryption routine, the ransomware appends the extension, .cerber to its locked files. A ransom note, resembling that of the ransomware it impersonates, then appears directing all transactions to a Bitcoin network.

Here are other notable ransomware stories that surfaced in the past two weeks:

The other variant (detected by Trend Micro as RANSOM_CITOXE.B) masquerades as a Google Chrome updater, deliberately tricking the would-be victim by spoofing the Google Chrome icon.  Similar to the previous variant, it disables the Task Manager and carries out its encryption routines using the AES algorithm. Once its encryption routine is done, it encodes filenames and adds the .angelamerkel extension to the encrypted files. This then leads to the display of a ransom note with the image of Angela Merkel, asking for a rather hefty ransom of 1200 euro in bitcoins, amounting to more than US$1,280. Within the same period, another ransomware variant that resembles Exotic surfaced. Shell Locker (detected by Trend Micro as RANSOM_EXOSHELL.A) drops a copy of itself in the targeted system’s Startup folder, enabling it to automatically execute upon reboot. After its encryption routine, it appends the extension .L0cked to the filename of its infected files. A ransom note then notifies the victim that all photo, video, and audio files are encrypted and can only recovered when the ransom of $100 ransom in bitcoins is paid within 48 hours. As with other variants that uses this similar ploy, it threatens to delete the encrypted files when the ransom is ignored.

iRansom (detected by Trend Micro as RANSOM_ILOCKED.A) is one of the few ransomware variants that threatens to delete the decryption key instead of the hostaged files commonly seen in other families. Upon successful encryption, this variant appends the extension .Locked to the file names of each locked file. This then leads to the display of a pop-up screen that contains the ransom note, which demands a ransom of 0.15 bitcoins ($110) on a 48-hour deadline.

Recently, developers took a liking to the popular Hollywood TV series again, spawning another ransomware variant with a name that matches the earlier ransomware variant. This time, FSociety (detected by Trend Micro as RANSOM_REMINDMEFSOCIETY.A) made its presence felt with a working sample that is based on the Hidden Tear-based variant, Remind Me. This version of FSociety appends the extension name .dll to the filenames of its locked files. An undisclosed ransom payment is demanded from the victims on a five-day deadline. Failure to settle the ransom will then lead to the deletion of the encrypted files.

The continuing rise of new and updated variants and families shows that cybercriminals are still raking in profits. A multi-layered approach is vital to defend against ransomware. That way, all possible gateways of compromise remains intact and secure. A solid back-up of valuable files, on the other hand, mitigates the damage brought by a ransomware infection.

Ransomware solutions: